EP4667301A1 - Operating system for a vehicle, and vehicle and method for operating a vehicle with an operating system - Google Patents

Abstract

The invention relates to an operating system (100) for a vehicle (300), wherein the operating system (100) comprises a first operating unit (110). The first operating unit (110) has a first primary input acquisition unit (112), a first secondary input acquisition unit (118), a first communication unit (122), and a first interface (128). The first communication unit (122) is connected to the first interface (128) to receive second secondary electrical information (122). The first communication unit (122) is further configured to transmit data (124) to the primary control unit (126) depending on the second secondary electrical information (122).

The invention further relates to a vehicle (300) with an operating system and a method (400) for operating a vehicle with an operating system.

Description

The invention relates to the field of vehicles and in particular to the field of commercial vehicles, such as trucks, semi-trailer trucks or agricultural tractors.

Modern vehicles contain a multitude of control units, also known as "electronic control units" or ECUs for short. These control units are used to manage various vehicle functions. For example, they primarily control vehicle actuators and read data from vehicle sensors. Examples of vehicle control units include brake control units (EBS) for controlling various braking functionalities, such as friction brakes or the vehicle's parking brake, and air suspension control units for controlling air suspension systems.

Electronic control units (ECUs) in modern vehicles are sometimes interconnected via a vehicle network, particularly a data bus, to exchange data. For example, an air suspension system ECU can determine the vehicle's mass. A sensor measures the pressure within the air springs and transmits this information to the ECU. From this pressure, the ECU can calculate the mass and provide it to other components, such as a brake control unit. The brake control unit can then use this mass to control the actuators.

Furthermore, redundant control units are provided for various applications, particularly safety-critical ones. Thus, it is known that vehicles, for example, have a primary control unit, such as a primary brake control unit, and a secondary control unit, such as a secondary brake control unit. The primary and secondary control units have essentially the same functionality, so the primary control unit performs its assigned function until a replacement, for example by a In the event of an error, reactivation is no longer possible. In this case, the secondary control unit takes over the functions of the primary control unit. To further increase reliability, in addition to the redundant control units, redundancies are often provided in the actuators controlled by the control units. Sensors that provide input signals for the control units are also frequently redundant.

Accordingly, vehicle controls, such as pedals or switches, which are operated by a driver, are equipped with redundant sensors in order to be able to provide sensor values from a second sensor, such as a secondary sensor, in case of a failure of one of the sensors, for example a primary sensor, and thus increase the reliability and therefore the overall safety of the vehicle.

To achieve the described high reliability, complex wiring is required. For example, each control element with redundant sensors must have separate electrical connections between the sensors and the control unit to enable the complete chain, at least up to redundant control units. In addition to the redundant sensors in the control element, a redundant communication unit must also be provided. A primary sensor of a control element is thus connected to a primary control unit via a primary communication unit, while the secondary sensor is connected to a secondary control unit via a secondary communication unit. Compared to non-redundant control elements and control units, this effectively doubles the wiring effort between each control element and the control unit.

Particularly in the commercial vehicle sector, the cable connection between the interior of the cab and the vehicle frame, where the control units are typically located, is especially critical due to the presence of sprung or even foldable driver's cabs. This is because relative movement between the driver's cab and the vehicle frame is possible. As the number of electrical connections in this area of relative movement increases, and the resulting increase in required installation space (which is sometimes limited), the risk of cable breakage and thus system failure is further heightened.

The object of the present invention is therefore to address the problems of the prior art. In particular, it aims to provide a way to establish redundant communication between operating elements and control units, thereby reducing the risk of defective cable connections between the operating elements and the control units or the cabling effort, or at least ensuring that this is not exacerbated despite the redundant design. In any case, the object of the present invention is to find an alternative to what is known from the prior art.

According to the invention, an operating system according to claim 1 is therefore proposed.

Accordingly, an operating system is proposed that comprises a first operating unit. The first operating unit has a first primary input acquisition unit and a first secondary input acquisition unit. The first primary input acquisition unit serves to acquire initial inputs to the first operating unit, and the first secondary input acquisition unit also serves to acquire initial inputs to the first operating unit. The first primary input acquisition unit is configured to output initial primary electrical information depending on the acquired initial inputs and preferably to generate the initial primary electrical information for output depending on the acquired initial inputs. The first secondary input unit is configured to output initial secondary electrical information depending on the acquired initial inputs and preferably to generate the initial secondary electrical information for output depending on the acquired initial inputs.

The initial inputs correspond to, or result from, a mechanical movement performed by the vehicle's driver to indicate a driver request. These initial inputs could be, for example, different switch positions or different positions of a pedal or gear selector. The first primary input acquisition unit, like the first secondary input acquisition unit, captures these initial inputs, and both independently generate corresponding electrical information: the first primary electrical information and the first secondary electrical information.

Furthermore, the first operating unit comprises a first communication unit connected to the first primary input acquisition unit. The communication unit is configured to receive the first primary electrical information and, preferably, to generate data based on this information and transmit it to a primary control unit. The first inputs are thus converted into first primary electrical information by the first primary input acquisition unit, and this data is then transmitted to a primary control unit via the first communication unit. The primary control unit can then be used to control actuators or other systems based on the first inputs and parameters stored in the primary control unit or sensor values received by the primary control unit.

Furthermore, the first operating unit includes a first interface for connecting to a second operating unit. This first interface serves to receive secondary electrical information from a second secondary input acquisition unit of the second operating unit. Thus, an interface is provided by which a further, namely the second, operating unit can be connected to the first operating unit in such a way as to receive further electrical information, namely the second secondary electrical information, from an input acquisition unit outside the first operating unit, namely from the second secondary input acquisition unit of the second operating unit.

The first communication unit is also connected to the first interface to receive the second secondary electrical information from the second control unit and to transmit data to the primary control unit based on this second secondary electrical information. Thus, the first communication unit is configured to transmit data to the primary control unit not only based on the first primary electrical information from the first control unit, but also based on the second secondary electrical information from a second control unit.

The first operating unit thus preferably represents a redundant communication link for another operating unit, thereby enabling additional redundant connections between the operating units via the interface between operating units. and the control units can be dispensed with. The invention is based on the knowledge that additional wiring between operating units is less prone to errors than additional connections between each individual operating unit and the control units.

According to a first embodiment, the first control unit comprises a first power supply module for supplying power to the first primary input acquisition unit and/or the first communication unit. The first power supply module can be connected, for example, to a primary power source of the vehicle or a primary control unit to draw power from it. The first power supply module thus serves to supply power to the primary input acquisition unit and the first communication unit. In the simplest case, the first power supply module can simply be a device for receiving power from a primary power source, such as a vehicle battery, preferably via a connection of the first control system, and distributing it directly to the first communication unit and the first primary input acquisition unit. However, the first power supply module can also be configured as a voltage converter to obtain power at a voltage of, for example, 12 or 24 volts from a vehicle battery and transform it down so that, for example, a voltage of 5 volts is output for the first communication unit and the first primary input acquisition unit. Furthermore, the first power supply module is connected to the first interface and configured to output power via the first interface, so that the first interface is configured to supply the second secondary input acquisition unit of the second operating unit with power from the first power supply module.

The first operating unit thus not only provides a redundant communication channel for another operating unit, but is also designed to supply power to a redundant input acquisition unit of a second operating unit, in order to enable the independent operation of secondary components for a second operating unit, completely independent of the primary components of the second operating unit.

According to another embodiment, the first secondary input acquisition unit is connected to the first interface. The first secondary input acquisition unit It is configured to output the first secondary electrical information depending on the initial inputs received at the first interface. The first secondary electrical information from the first secondary input acquisition unit is thus provided via the interface, so that it can be made available to a secondary control unit via a further operating unit, such as a second operating unit, which is preferably identical to the first operating unit.

The first secondary input acquisition unit with the first interface thus simultaneously enables a redundant data path or communication channel for the first operating unit.

Preferably, the first secondary input acquisition unit is galvanically isolated or separable from the first communication unit and/or the first power supply module. The first secondary input acquisition unit is also preferably galvanically isolated or separable from the first primary input acquisition unit.

Therefore, faults in the first primary input acquisition unit, the first communication unit, or the first power supply module cannot affect the first secondary input acquisition unit, or vice versa.

According to a further embodiment, the operating system comprises a second operating unit. The second operating unit has a second primary input acquisition unit for acquiring second inputs to the second operating unit and for outputting second primary electrical information depending on the acquired second inputs. Furthermore, the second operating unit comprises a second communication unit connected to the second primary input acquisition unit. The communication unit is configured to receive the second primary electrical information and to transmit data to a secondary control unit depending on the second primary electrical information.

Accordingly, the second control unit records secondary inputs that differ from the first. These secondary inputs can also be generated by the driver by pressing a switch, a pedal, or similar device.

The second primary input acquisition unit converts the secondary inputs, which preferably correspond to or result from mechanical movements or positions of a movable element, into electrical information or signals—namely, the secondary primary electrical information—in order to send it to the second communication unit. The second communication unit then generates data from this information, representing the secondary inputs, which is transmitted to a secondary control unit.

Furthermore, the second operating unit also includes an interface, namely a second interface, for connecting to the first operating unit. Preferably, the first and second interfaces of the operating system are interconnected. The second interface enables the second operating unit to receive the first secondary electrical information from the first secondary input acquisition unit of the first operating unit. The second communication unit is also connected to the second interface to receive this first secondary electrical information. The second communication unit is further configured to transmit data to the secondary control unit based on this first secondary electrical information.

Accordingly, the second communication unit is set up to generate data depending on the second primary electrical information representing the second inputs, and data depending on the first secondary electrical information representing the first inputs, and to send it to the secondary control unit.

Thanks to the first and second interfaces, as well as the two operating units, a redundant data path can be created for the first operating unit via the second operating unit and vice versa. In the event of a failure of the first primary input acquisition unit, information from the first secondary input acquisition unit, namely the first secondary electrical information, can be transferred via the first interface of the first operating unit to the second interface of the second operating unit and from there via the second communication unit to the secondary control unit. Preferably, the secondary control unit is functionally identical to the primary control unit and is configured to transmit either the first secondary electrical information in the event of a failure or the second primary information. To forward electrical information received via the second control unit from the second communication unit to the primary control unit. The data can also be processed directly in the secondary control unit if a fault occurs in the primary control unit.

According to a further embodiment, the second control unit comprises a second power supply module for powering the second primary input acquisition unit and the second communication unit. Furthermore, the second interface of the second control unit is configured to supply the first secondary input acquisition unit of the first control unit with power from the second power supply module.

This allows the first secondary input acquisition unit to be powered via the second operating unit, provided the first power supply module is galvanically isolated from the first secondary input acquisition unit and other components of the first operating unit. Completely independent acquisition of the first inputs by the first secondary input acquisition unit and the corresponding forwarding of the resulting information and data is thus independent of the other modules or units of the first operating unit, and therefore possible even if these other modules or units fail. In particular, the routing via the operating units ensures that the functionality of the operating units remains unaffected in the event of a failure or malfunction of the primary control unit.

According to a further embodiment, the second control unit comprises the second secondary input acquisition unit for acquiring the second inputs to the second control unit. The second control unit thus comprises two input acquisition units, namely the second primary input acquisition unit and the second secondary input acquisition unit. Both input acquisition units acquire the second inputs. The second primary input acquisition unit generates the second primary electrical information based on the acquired second inputs, and the second secondary input acquisition unit generates the second secondary electrical information based on the acquired second inputs. The second secondary electrical information is output at the second interface.

Thus, the second secondary electrical information is transmitted via the second interface to the first interface of the first control unit, so that in the event of a fault of the second primary input acquisition unit or the second communication unit, the first control unit can transfer the information to the primary control unit.

According to a further embodiment, the first control unit is a service brake control unit comprising a pedal, wherein the first primary input acquisition unit comprises a primary sensor and the first secondary input acquisition unit comprises a secondary sensor. The primary sensor and the secondary sensor are each configured to detect a pedal position as the first inputs. The primary sensor is configured to generate the first primary electrical information depending on the pedal position, and the secondary sensor is configured to generate the first secondary electrical information depending on the pedal position.

A safe service brake control unit can thus be implemented.

According to a further embodiment, the second control unit corresponds to a parking brake control unit. The parking brake control unit has a hand-held control element, such as a switch or lever. Accordingly, the second primary input detection unit comprises a primary position detection unit, and the second secondary input detection unit comprises a secondary position detection unit. The position detection units are each configured to detect at least a first position and a second position of the hand-held control element. Preferably, additional positions can be provided and detected besides the first and second positions. The first position of the hand-held control element corresponds to a parking brake activation request, with which the driver preferably requests the engagement of a parking brake. The second position preferably corresponds to a parking brake deactivation request; that is, the driver places the hand-held control element, such as the lever or switch, in this position to deactivate a parking brake. If the second position or a further position is engaged while driving, such a position can additionally be recognized as an auxiliary brake request, with which the driver, for example, requests continuous deceleration, such as in the case of a downhill slope. The primary position detection unit is set up, depending on the detected position, which to generate the second primary electrical information and the secondary position detection unit is set up to generate the second secondary electrical information depending on the detected position.

It is advantageous to provide a second operating unit, preferably the second, as a parking brake control unit, in addition to the first, since increased reliability is required when engaging the parking brake. The combination of the first operating unit as a service brake control unit and the second operating unit as a parking brake control unit is particularly advantageous. This combination of the two operating units in the control system is beneficial because both the service brake control unit and the parking brake control unit communicate with the same type of control unit, for example, a brake control unit, to request their respective braking commands. Data from the corresponding communication units can thus be transmitted to the same functional control unit, thereby avoiding the need to forward the data to another control unit.

According to a further embodiment, the first communication unit is configured to receive third-party electrical information from a state-sensing unit, in particular a steering angle sensor, via the first interface or a first further interface. The steering angle sensor, for example, indicates a steering angle of the vehicle and outputs this as third-party electrical information. The first communication unit is further configured to transmit data to the primary control unit depending on the third-party electrical information.

Alternatively or additionally, the second communication unit is configured to receive the third electrical information from the condition monitoring unit via the second interface or a second additional interface. The second communication unit is also configured to transmit data to the secondary control unit based on this third electrical information. The control units can thus be used to transmit further data, such as sensor data indicating the state of an element in the vehicle cabin, or, if both control units are connected to the condition monitoring unit, even to transmit this data redundantly. Additional connecting lines or data cables between control units mounted on the vehicle chassis and... Elements in the driver's cab area can thus be reduced or eliminated.

According to a further embodiment, the first control unit comprises a first plausibility unit for verifying the plausibility of the first primary electrical information against the first secondary electrical information. Alternatively or additionally, the second control unit also comprises a second plausibility unit. The second plausibility unit is configured to verify the plausibility of the second primary electrical information against the second secondary electrical information. The plausibility units ensure that deviations in the electrical information generated from the corresponding inputs are detected. If necessary, the system can switch from processing the electrical information identified as erroneous to processing the redundant electrical information.

According to one embodiment, the first and/or second plausibility unit can be supplied with further signals for plausibility checks, in particular the corresponding electrical information. Such further signals are preferably electrical signals from, for example, further sensors, especially the respective associated operating units, or further signals from further control units.

For example, at least one limit switch can be provided in the first and/or second control unit next to the input detection units to detect a defined position of a switch, pedal, or selector lever and forward it as a further signal to the corresponding plausibility unit. These additional signals can then be taken into account during plausibility checks.

Alternatively or additionally, a first input acquisition unit can be provided in the first operating unit and a second input acquisition unit in the second operating unit. The first inputs can be acquired with the first input acquisition unit, and the second inputs can be acquired with the second input acquisition unit. Electrical signals from the first input acquisition unit can thus be fed to the first plausibility unit for validation, and electrical signals from the second input acquisition unit can be fed to the second plausibility unit for validation.

According to another embodiment, the operating system comprises the primary control unit and/or the secondary control unit.

According to a further embodiment, a data connection is provided between the primary and secondary control units to exchange data between them. This data connection is preferably configured to validate the first primary electrical information against the first secondary electrical information and/or the second primary electrical information against the second secondary electrical information. Accordingly, validation does not take place in the control units or in addition to the control units. In particular, if validation is performed exclusively by the primary and secondary control units, galvanic isolation of the individual detection units in the control units is possible. The data connection preferably also serves to transmit the second primary electrical information from the secondary control unit to the primary control unit when the control system is functioning correctly.

According to a further embodiment, the primary control unit and/or the secondary control unit is a frame-mountable control unit. The primary control unit and/or the secondary control unit are designed to be mounted on the vehicle in a position rigid relative to the vehicle frame.

Furthermore, the invention relates to a vehicle with an operating system according to one of the aforementioned embodiments.

Furthermore, the invention relates to a method for operating a vehicle with an operating system according to one of the aforementioned embodiments.

According to one embodiment, in the case of a fault-free first operating unit and a fault-free primary control unit, the method first comprises acquiring initial inputs with a first primary input acquisition unit. Furthermore, initial primary electrical information is output by the first primary input acquisition unit, depending on the acquired initial inputs. Additionally, data is transmitted to a [missing information] depending on the initial primary electrical information. The primary control unit transmits data to a first communication unit. In the aforementioned error-free case, the procedure further comprises the steps performed with a second operating unit, namely that second inputs are first acquired with a second primary input acquisition unit, and second primary electrical information is output by the second primary input acquisition unit depending on the acquired second inputs. Depending on the second primary electrical information, data is then transmitted to a secondary control unit by a second communication unit.

In the event of a fault in the first primary input acquisition unit, the first communication unit, and/or the primary control unit, the procedure comprises the following steps: First inputs are acquired by a first secondary input acquisition unit of the first operating unit, and first secondary electrical information is output by the first secondary input acquisition unit based on the acquired first inputs. Subsequently, the first secondary electrical information is transmitted from the first operating unit to the second operating unit via a first interface of the first operating unit and a second interface of the second operating unit. Data is then transmitted to a secondary control unit via the second communication unit, based on the first secondary electrical information.

Fig. 1

ein Bediensystem gemäß einem Ausführungsbeispiel,

Fig. 2

ein Fahrzeug mit dem Bediensystem und

Fig. 3

die Schritte eines Verfahrens zum Betreiben eines Fahrzeugs mit einem Bediensystem.

Further embodiments are shown in the exemplary embodiments explained in more detail in the figures. These show:

Fig. 1

an operating system according to an exemplary embodiment,

Fig. 2

a vehicle with the operating system and

Fig. 3

the steps of a procedure for operating a vehicle with an operating system.

Fig. 1 Figure 100 shows an operating system 100 for a vehicle. The operating system 100 comprises a first operating unit 110 and a second operating unit 210. In the Fig. 1 In the illustrated embodiment, the first control unit 110 corresponds to a service brake control unit 133, which includes a pedal 134 that has different pedal positions. 140 can be assumed. Depending on the pedal positions 140, initial inputs 114 are then provided for further processing. The second control unit 210 corresponds in the in Fig. 1 The illustrated embodiment of a parking brake control unit 233 comprises a hand control element 134, which can be moved by a driver at least between a first position 240a and a second position 240b. Depending on the position 240a, 240b, second inputs 214 are generated for further processing in the second control unit 210.

The first operating unit 110 comprises a first primary input acquisition unit 112 with a primary sensor 136 and a first secondary input acquisition unit 118 with a secondary sensor 138. Electrical information is generated depending on the first inputs 114 supplied to the first primary input acquisition unit 112 and the first secondary input acquisition unit 118. Thus, the first primary input acquisition unit 112 generates first primary electrical information 116 depending on the acquired first inputs 114. The first secondary input acquisition unit 118 generates first secondary electrical information 120 depending on the acquired first inputs 114.

The first primary electrical information 116 is supplied to a first communication unit 122, and data 124, generated by the first communication unit 122 based on the first primary electrical information 116, is transmitted to a primary control unit 126. The primary control unit 126 also provides energy 127 to a first power supply module 130, which supplies energy 132 to the first communication unit 122 and the first primary input acquisition unit 112. The primary control unit 126 then serves, for example, to control actuators not shown, such as brake actuators.

In an essentially identical or exactly identical structure, the second operating unit 210 comprises a second primary input acquisition unit 212 with a primary position acquisition unit 236, which, for example, also corresponds to a sensor, and a second secondary input acquisition unit 218 with a secondary position acquisition unit 238. The second inputs 214 are supplied to the second primary input acquisition unit 212 and the second secondary input acquisition unit 218. The second primary input acquisition unit 212 is used to... Then, depending on the acquired second inputs 214, second primary electrical information 216 is generated and output. With the second secondary input acquisition unit 218, second secondary electrical information 220 is generated and output accordingly, depending on the acquired second inputs 214. Furthermore, a second communication unit 222 is provided in the second operating unit 210, which receives the second primary electrical information 216 and generates data 224 from it in order to forward it to a secondary control unit 226. The secondary control unit 226 provides energy 227 for a second power supply module 230, which supplies energy 232 to the second primary input acquisition unit 212 and the second communication unit 222.

Furthermore, the first operating unit 110 comprises a first interface 128, and the second operating unit 210 comprises a second interface 228, with the first interface 128 being connected to the second interface 228. The first secondary input acquisition unit 118 is supplied with energy 232 from the second power supply module 230 via interfaces 128 and 228, and the first secondary electrical information 120 is transmitted to the second communication unit 222 via interfaces 128 and 228. Data 224 is transmitted from the second communication unit 222 to the secondary control unit 226, depending on the first secondary electrical information 120. The first secondary input acquisition unit 118 is thus galvanically isolated from the other components of the first operating unit 110. A first plausibility unit 154 can be provided as a purely optional feature, which verifies the plausibility of the first primary electrical information 116 against the first secondary electrical information 120. This first plausibility unit 154 is shown with dashed lines because it can optionally be provided at this location, but is preferably arranged in the primary control unit 126 or in the secondary control unit 226 and is thus only an optional feature of this embodiment. Preferably, the first plausibility unit 154 is not provided in the first control element 110 in order to achieve the aforementioned complete galvanic isolation.

Likewise, the second secondary electrical information 220 is transmitted via interfaces 128, 228 to the first communication unit 122 in order to generate data 124 for the primary control unit 126. The second secondary input acquisition unit 218 is also supplied with energy 132 from the first power supply module 130 via interfaces 128, 228 and is thus galvanically isolated from the other components of the second control unit 210. Here, too, according to a special embodiment, a second plausibility unit 254 is shown by a dashed line to verify the plausibility of the second primary electrical information 216 against the second secondary electrical information 220. Preferably, however, this module is not provided if complete galvanic isolation of the second secondary input acquisition unit 218 from the other components or elements of the second control unit 210 is desired. Plausibility verification can preferably be carried out via a data connection 160 between the primary control unit 126 and the secondary control unit 226. Furthermore, the first control element 110 includes a first additional interface 142, which is also provided accordingly in the form of a second interface 242 on the second control element 210. The first additional interface 142 is connected to a state detection unit 144, which corresponds, for example, to a steering angle sensor 146 for detecting a rotation angle 148 of a steering system 150, in order to receive third electrical information 152. The state detection unit 144 could also be connected to the second communication unit 222 via the second additional interface 242 in order to receive the third electrical information 152 and transmit corresponding data 224 to the secondary control unit 226.

Fig. 2 Figure 1 shows a vehicle 300 with the operating system 100, which comprises the first operating unit 110 and the second operating unit 210. A status monitoring unit 144 is connected to the first operating unit 110. The first operating unit 110 is connected via the first interface 128 to the second interface 228 of the second operating unit 210. The first operating unit is also connected to the primary control unit 126, and the second operating unit 210 is connected to the secondary control unit 226. A data connection 160 is provided between the primary control unit 126 and the secondary control unit 226 for data exchange. The primary control unit 126 is connected to all actuators 310, which correspond, for example, to brake actuators, for controlling these actuators. The secondary control unit 226 is also connected to all actuators 310 for controlling these actuators 310 in the event that the primary control unit 126 fails, for example. Furthermore, a vehicle frame 302, running longitudinally along the vehicle, is shown purely as an example in the form of a web. The primary control unit 126 is rigidly connected to the vehicle frame 302 at a first position 304a, and the secondary control unit 226 is rigidly connected to it at a second position 304b. In contrast, the operating elements 110 and 210 are located in a configuration not shown here.

The driver's cab is arranged in a manner that is either sprung or foldable relative to the vehicle frame 302. A relative movement between the operating elements 110, 210 and the control units 126, 226 can therefore occur.

Fig. 3 Figure 400 shows the steps of procedure 400 according to an exemplary embodiment. In step 402, it is first checked whether the first operating unit 110 and the primary control unit 126 are error-free. If so, in step 406, first inputs 114 are acquired by the first primary input acquisition unit 112, and in step 408, first primary electrical information 116 is output depending on the acquired first inputs 114. In step 410, the first primary electrical information 116 is transmitted in the form of data 124 to a primary control unit 126. Furthermore, in step 412, second inputs 214 are acquired by a second primary input acquisition unit 212, and in step 414, second primary electrical information 216 is output by the second primary input acquisition unit 212 depending on the acquired second inputs 214. In step 416, data 224 is output by a second communication unit 222, depending on the second primary electrical information 216. If an error 418 of the first primary input acquisition unit 112, the first communication unit 122, or the primary control unit 126 is detected in step 402, steps 420, 422, and 424 are executed instead of steps 406, 408, and 410. Steps 412, 414, and 416 are executed as described previously in the aforementioned error case. In step 420, the first inputs 114 are acquired by a first secondary input acquisition unit 118, and the first secondary input acquisition unit 116 outputs the first secondary electrical information 120 in step 422. In step 424, the first secondary electrical information 120 is transmitted from the first operating unit 110 to the second operating unit 210 via a first interface 128 and a second interface 228. In step 426, data 224 is transmitted to a secondary control unit 226 via a second communication unit 222 of the second operating unit, depending on the first secondary electrical information 120.

Reference symbol (part of the description)

100

operating system

110

first control unit

112

first primary input capture unit

114

first entries

116

first primary electrical information

118

first secondary input capture unit

120

first secondary electrical information

122

first communication unit

124

Data

126

primary control unit

127

energy

128

first interface

130

first energy supply module

132

energy

133

Service brake control unit

134

pedal

136

primary sensor

138

secondary sensor

140

Pedal positions

142

first further interface

144

Condition monitoring unit

146

Steering angle sensor

148

Rotation angle

150

steering

152

third electrical information

154

first plausibility check unit

160

Data connection

210

second control unit

212

second primary input capture unit

214

second entries

216

second primary electrical information

218

second secondary input capture unit

220

second secondary electrical information

222

second communication unit

224

Data

226

secondary control unit

227

energy

228

second interface

230

second energy supply module

232

energy

233

Parking brake control unit

236

primary position detection unit

238

secondary position detection unit

240a

first position

240b

second position

242

second further interface

254

second plausibility unit

300

vehicle

302

Vehicle frame

304a

first position

304b

second position

310

Actuators

400

Proceedings

402

Check if the first control unit and primary control unit are fault-free.

404

error-free

406

Enter initial information

408

Output first primary electrical information

410

Transmit first primary electrical information

412

Capture second input

414

Output second primary electrical information

416

Output data

418

Mistake

420

Enter initial information

422

Output first secondary electrical information

424

Transmit first secondary electrical information

426

Transfer data

Claims (15)

Operating system (100) for a vehicle (300), wherein the operating system (100) comprises a first operating unit (110) and the first operating unit (110) includes: - a first primary input acquisition unit (112) for acquiring first inputs (114) into the first operating unit (110) and for outputting first primary electrical information (116) depending on the acquired first inputs (114), - a first secondary input acquisition unit (118) for acquiring the first inputs (114) into the first operating unit (110) and for outputting first secondary electrical information (120) depending on the acquired first inputs (114), - a first communication unit (122) connected to the first primary input acquisition unit (112) to receive the first primary electrical information (116), the first communication unit (122) further being configured to transmit data (124) to a primary control unit (126) depending on the first primary electrical information (116), and - a first interface (128) for connecting to a second operating unit (210) to receive second secondary electrical information (220) from a second secondary input acquisition unit (218) of the second operating unit (210), wherein the first communication unit (122) is connected to the first interface (128) to receive the second secondary electrical information (122), and wherein the first communication unit (122) is further configured to transmit data (124) to the primary control unit (126) depending on the second secondary electrical information (220). Operating system according to claim 1, wherein the first operating unit (110) comprises a first power supply module (130) for supplying power (132) to the first primary input acquisition unit and/or the first communication unit (122), wherein the first interface (128) is configured to supply the second secondary input acquisition unit (218) of the second operating unit (210) with power (132) from the first power supply module (130). Operating system (100) according to claim 1 or 2, wherein the first secondary input acquisition unit (118) is connected to the first interface (128) to output the first secondary electrical information (120) depending on the acquired first inputs (114) at the first interface (128), wherein preferably the first secondary input acquisition unit (118) is galvanically isolated or separable from the first communication unit (122) and/or the first power supply module (130). Operating system (100) according to one of the preceding claims, wherein the operating system (100) comprises the second operating unit (210) and has the second operating unit (210): - a second primary input acquisition unit (212) for acquiring second inputs (214) into the second operating unit (210) and for outputting second primary electrical information (216) depending on the acquired second inputs (214), - a second communication unit (222) connected to the second primary input acquisition unit (212) to receive the second primary electrical information (216), the second communication unit (222) further being configured to transmit data (224) to a secondary control unit (226) depending on the second primary electrical information (216), and - a second interface (228) for connecting to the first control unit (110) to receive the first secondary electrical information (120) from the first secondary input acquisition unit (118) of the first control unit (110), wherein the second communication unit (222) is connected to the second interface (228) to receive the first secondary electrical information (120), and wherein the second communication unit (222) is further configured to transmit data (224) to the secondary control unit (220) depending on the first secondary electrical information (120). Operating system (100) according to claim 4, wherein the second operating unit (210) comprises a second power supply module (230) for supplying power (232) to the second primary input acquisition unit (212) and the second communication unit (222), wherein the second interface (228) is configured to supply the first secondary input acquisition unit (118) of the first operating unit (110) with power (232) from the second power supply module (230). Operating system (100) according to one of claims 4 or 5, wherein the second operating unit (210) comprises the second secondary input acquisition unit (218) for acquiring the second inputs (214) into the second operating unit (210) and for outputting second secondary electrical information (220) depending on the acquired second inputs (214) at the second interface (228), wherein preferably the second secondary input acquisition unit (218) is galvanically isolated or separable from the second communication unit (222) and/or the second power supply module (230). Operating system (100) according to one of the preceding claims, wherein the first operating unit (110) is a service brake operating unit (133) having a pedal (134), wherein the first primary input detection unit (112) comprises a primary sensor (136) and the first secondary input detection unit (118) comprises a secondary sensor (138) to each detect a pedal position (140) of the pedal (134) as first inputs (114) and the primary sensor (136) is configured to generate the first primary electrical information (116) depending on the pedal position (140), and the secondary sensor (138) is configured to generate the first secondary electrical information (120) depending on the pedal position (140). Operating system (100) according to one of the preceding claims, wherein the second operating unit (210) is a parking brake operating unit (233) comprising a hand control element (234), wherein the second primary input detection unit (212) comprises a primary position detection unit (236) and the second secondary input detection unit (218) comprises a secondary position detection unit (238) to detect at least a first position (240a) of the hand control element (234) and a second position (240b) of the hand control element (234), wherein the primary position detection unit (236) is configured to generate the second primary electrical information (216) depending on the detected position (240a, 240b), and the secondary position detection unit (238) is configured to generate the second secondary electrical information (220) depending on the detected position (240a, 240b). Operating system (100) according to one of the preceding claims, wherein the first communication unit (122) is configured to communicate via the first interface (128) or a first further interface (142) from a state detection unit (144), in particular a steering angle sensor (146), which for example indicates a rotation angle (148) of a steering system (150) of the vehicle (300), to receive third electrical information (152) and to transmit data (124) to the primary control unit (126) depending on the third electrical information (152) and/or
the second communication unit (222) is set up to receive the third electrical information (252) from the status acquisition unit (144) via the second interface (228) or a second further interface (242) and to transmit data (224) to the secondary control unit (226) depending on the third electrical information (152) with the second communication unit (222). Operating system (100) according to one of the preceding claims, wherein the first operating unit (110) comprises a first plausibility unit (154) to plausibly compare the first primary electrical information (116) with the first secondary electrical information (120) and/or
the second control unit (210) includes a second plausibility unit (254) to verify the plausibility of the second primary electrical information (216) against the second secondary electrical information (220). Operating system (100) according to one of the preceding claims, wherein the operating system (100) comprises the primary control unit (126) and/or the secondary control unit (226). Operating system (100) according to claim 11, wherein the primary control unit (126) and the secondary control unit (226) have a data connection (160) and are configured to verify the plausibility of the first primary electrical information (116) against the first secondary electrical information (120) and/or the second primary electrical information (216) against the second secondary electrical information (220). Operating system (100) according to claim 11 or 12, wherein the primary control unit (126) and/or the secondary control unit (226) is a frame-mountable control unit (126, 226) which is configured to be mounted on the vehicle (300) at a position (304a, 304b) that is rigid relative to a vehicle frame (302). Vehicle (300) with an operating system (100) according to one of claims 1 to 13. Method (400) for operating a vehicle (300) with an operating system (100) according to any one of claims 1 to 13, wherein the method (400) preferably i) the steps performed with a first control unit (210) in the case of a fault-free (404) first control unit (210) and a fault-free primary control unit (126) include: - Capture (406) of initial inputs (114) with a first primary input capture unit (112), - Output (408) of first primary electrical information (116) depending on the acquired first inputs (114) with the first primary input acquisition unit (112), - Transmitting (410) data (124) depending on the first primary electrical information (116) to a primary control unit (126) with a first communication unit (122), ii) and the procedure includes the steps performed with a second control unit: - Capture (412) of second inputs (214) with a second primary input capture unit (212), - Output (414) of second primary electrical information (216) depending on the detected second inputs (214) with the second primary input detection unit (212), - Transmission (416) of data (224) depending on the second primary electrical information (216) to a secondary control unit (226) by means of a second communication unit (222), iii) wherein, in the event of a fault (418) of the first primary input acquisition unit (112), a fault (418) of the first communication unit (122) and/or a fault (418) of the primary control unit (126), the procedure comprises the following steps: - Capture (420) of first inputs (114) with a first secondary input capture unit (116) of the first operating unit (110), - Output (422) of first secondary electrical information (120) depending on the acquired first inputs (114) with the first secondary input acquisition unit (120), - Transmission (424) of the first secondary electrical information (120) from the first control unit (110) to the second control unit (210) by means of a first interface (128) of the first control unit (110) and a second interface (228) of the second control unit (210) and - Transmission (426) of data (224) depending on the first secondary electrical information (216) to a secondary control unit (226) by the second communication unit (222).